A Sextortion Demand That Passed SPF, DKIM, and DMARC

A message announcing itself as a delivery failure notice landed in the mailbox of a vice president at a small computer sales and services company. What it carried was a wall of nothing: a body that looked blank, one image attachment, and a From address matching the recipient's own.

The message had authenticated perfectly. SPF passed. DKIM passed. DMARC passed. Composite authentication returned a pass. Attachment scanning returned clean, and it was right to. There was no executable, no macro, no link, no landing page, and no attacker-registered domain anywhere in the case. The only thing in the message that constituted an attack was a demand for 1,700 dollars in Bitcoin, and it existed exclusively as pixels.

A Bounce Notice That Was Never a Bounce

Two things in the headers disagreed with each other, and neither disagreement is something an authentication check can express.

The first was the subject. It read as a routine delivery status notification, except that the phrase had zero-width joiner characters wedged between its letters. Those characters render as nothing at all, so a human sees clean text while exact-subject clustering sees a string matching no known template. Nobody inspects a bounce.

The second was the sender. The From address and the To address were the same string: the recipient's own mailbox. Self-addressed mail is a very old tell, and it survives because it is a formatting choice rather than a protocol violation. Nothing in SPF, DKIM, or DMARC examines whether a sender is claiming to be the person receiving the message. Alignment is a domain-level question, and From equalling To is a semantic anomaly.

The Only Real Content in the Message Was Pixels

The attachment was a PNG a little over 30,000 bytes. Rendered, it displayed the whole attack: an accusation that the recipient's device had been compromised, a demand for 1,700 dollars in Bitcoin, a bech32 wallet address, a short deadline, and instructions on which exchanges to use. Standard mass-market sextortion, of the kind whose claims almost never survive any scrutiny.

None of that text existed as text. Content classification had nothing to parse, keyword rules had nothing to match, and data-loss prevention had no string to catch. The image was recovered and read only because the case pipeline runs an image inspector across attachments, which is the one control in the chain that operates on the same surface the human does.

Binary analysis came back clean, and the detail worth keeping is that the verdict was accurate. There was no embedded executable, no data appended past the image trailer, and no least-significant-bit steganography. This is not the payload-in-a-picture pattern where an image is a smuggling container. The picture is the payload. Malware analysis measures whether a file can execute, and this file could not.

White Text, White Background, Deliberate Typos

The visible body was not empty, it was camouflaged: several paragraphs of generic corporate filler set in white on a white background, invisible to the reader and fully readable by a parser.

The filler had been run through a synonym-and-substitution scrambler, which left it studded with near-miss words: "moducts" for products, "moductivity" for productivity. That degradation is the point. It defeats fingerprinting on repeated boilerplate while still handing a content classifier a comfortable volume of business-sounding prose to score as unremarkable.

So the two views of this message inverted. A person saw a financial threat and no readable text. A parser saw several hundred words of bland commerce copy and an attachment it had cleared. Only the comparison is alarming, and almost nothing in a conventional pipeline performs it.

See Your Risk: Calculate how many threats your SEG is missing

Borrowed Authentication From a Bystander

The message did not originate inside the victim's tenant. It was submitted through an authenticated account on a shared web-hosting platform, belonging to a hosting customer whose domain is a quarter of a century old, registered through a mainstream registrar and pointed at the provider's own name servers. From there it passed through that provider's commercial outbound filtering relay and into Microsoft 365.

Every check along that path returned what it was supposed to. The DKIM signature verified against the hosting customer's domain, which is correct, because that is who actually sent the bytes. SPF passed for the header From domain because the relay's sending address fell inside a range the victim's own published sender policy authorizes. DMARC needs only one aligned identifier, SPF supplied it, and the policy in the record was set to take no action anyway.

The failure is not a bug in anyone's implementation. It is an authorization that is too broad. Publishing a wide include for a shared relay grants every tenant on that relay the ability to pass SPF for your domain, including a tenant you have never heard of and an attacker who rents an account for the afternoon. The record was doing precisely what it said. What it said was too generous. Auditing what your own sender authentication records actually authorize, rather than confirming that they exist and pass, is the cheap fix here.

The relaying domain looks bad in a header dump and is not the adversary. The only asset the attacker genuinely controlled was a wallet.

What Actually Surfaced It

Nothing in the content flagged it, because the content was a picture and the picture was clean.

Our Adaptive AI scored the message at 89 percent confidence and labelled it for its recipient rather than for its payload, as a VIP recipient anomaly: a senior executive receiving a self-addressed message from outside the tenant with no prior relationship in either direction. The automated triage bucketed the content itself as bulk mail rather than as an attack, which is the honest reading of what a parser could see and the wrong reading of what the file contained. A human analyst reviewed the case, approved it, and pulled the message from the one affected mailbox the same day. No payment.

That split verdict is the useful artifact. Authentication said legitimate. Malware analysis said clean. Content classification said bulk. All three were correct within their own scope, and the message was still a live financial threat aimed at a named executive. The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches, and the 2023 FBI Internet Crime Report counts business email compromise alone at roughly 2.9 billion dollars in reported losses. Neither figure comes from mail that fails a check.

What to Change After a Case Like This

Treat a From address matching the recipient's own mailbox as a hard signal on inbound mail from outside the tenant, independent of the authentication result. Compare the visible surface of a message against its extractable text and score the disagreement, because an image-only body paired with a wall of invisible filler is measurable without reading either. Run image inspection on attachments as routine, since an attachment can be genuinely clean and still be the entire attack. And review your own sender policy for includes broad enough to let a stranger authenticate as you.

CISA's phishing guidance and NIST's definition of phishing both frame this as an attack on a judgment rather than on a parser. Extortion is the purest version. There is no infrastructure to block, no credential to rotate, and no malware to remove. There is a frightened person, a deadline, and a wallet address, delivered inside an envelope that every control in the path agreed was fine.

Indicators of Compromise

MITRE ATT&CK Mapping